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This paper proposes a methodology for evaluating a controller’s ability to sat- 
isfy a set of closed-loop specifications when the plant has an arbitrary functional 
dependency on uncertain parameters. Control verification metrics applicable to 
deterministic and probabilistic uncertainty models are proposed. These metrics, 
which result from sizing the largest uncertainty set of a given class for which the 
specifications are satisfied, enable systematic assessment of competing control al- 
ternatives regardless of the methods used to derive them. A particularly attractive 
feature of the tools derived is that their efficiency and accuracy do not depend on 
the robustness of the controller. This is in sharp contrast to Monte Carlo based 
methods where the number of simulations required to accurately approximate the 
failure probability grows exponentially with its closeness to zero. This framework 
allows for the integration of complex, high-fidelity simulations of the integrated 
system and only requires standard optimization algorithms for its implementation. 
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Acronyms 


CPV : Critical Parameter Value 
CSR : Critical Similitude Ratio 
MS : Maximal Set 
PSM : Parametric Safety Margin 
RI : Reliability Index 


I. Introduction 

Most of the strategies for robust control design are based on attaining satisfactory worst-case 
stability and performance [1-5] . While and /t-analysis and synthesis 3 are the best methods for 
dealing with unstructured uncertainty, their intrinsic formulation render them overly conservative 
when dealing with parametric uncertainty. These methods usually lead to high-order controllers 
due to this conservatism and their emphasis on the worst-case. On the other hand, the control 
literature on parametric uncertainty has been mostly devoted to the robust stability of linear time 
invariant systems having affine and multi-affine parameter 6-9 dependencies. Notable exceptions to 
this case are made in References [10, 11] where polynomial parameter dependencies and approxi- 
mate feasibility are considered. However, the deployment of these strategies over other functional 
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forms requires over-bounding, a practice that introduces conservatism into the robustness analy- 
sis. Realistic control applications are subject to both stability and performance requirements that 
have an arbitrary functional dependency on the uncertain parameters and where the effect of the 
non-linear dynamics is important. 

The verification of satisfactory control effectiveness is a crucial task for safety-critical applica- 
tions where instability and poor performance may lead to the loss of a mission. Since this is the last 
software-based step in the control design cycle before control validation, the best dynamic model 
must be used. This leads to complex, non-linear, high-fidelity simulations where all subsystems, 
commonly developed independently with each using its own set of assumptions and methods, are 
integrated. Under these conditions, the vast majority of assumptions behind robust and adaptive 
control methods — e.g., linear dynamics, affine or multi-affine parameter dependencies, attain- 
ment of matching conditions — do not hold. Even though such assumptions enable the efficient 
manipulation of the problem and the generation of computationally viable control solutions, the 
physics of the system, or, at this stage, our best model of it, will ultimately validate the control 
practices exercised thus far. In accordance with this rationale, the framework proposed herein will 
develop mathematics applicable to any representation of the dynamic system, including the best 
one available. In the context of robustness analysis, this implies that the structure of the plant’s 
model is arbitrary and the controller, possibly designed using a simpler dynamic model based on a 
set of assumptions which we do not need to know, is available. 

The nature and scope of this more general problem commonly leads to the usage of sampling- 
based techniques, e.g., Monte Carlo analysis. When accurate robustness assessments are desired, the 
computational demands associated with these methods render them impractical. This is especially 
true when the number of uncertain parameters is large and when probabilities are small. To alleviate 
this limitation, this paper proposes an optimization-based methodology and a set of metrics for 
control verification applicable to systems subject to both robust stability and robust performance 
requirements. The framework derived is applicable to linear and nonlinear systems having an 
arbitrary control structure. Besides, the functional relationship between the design requirements 
and the uncertainty may only be known implicitly, e.g., the dependence of the time response 
of a nonlinear system on the uncertain parameters. Robustness will be quantified using both 
deterministic and probabilistic uncertainty models. The figures of merit for evaluating robustness 
are the Parametric Safety Margin, the Reliability Index, the Failure Probability, and upper bounds 
to this probability. The tools for the calculation of these metrics, which are applications to control 
of methods developed by the authors 12,13 only require the use of standard optimization algorithms. 

This paper is organized as follows. Basic concepts and notions are first introduced in Section 
II. Section III presents the mathematical background required to perform set deformations, an 
instrumental tool for the developments that follow. The formulation and tools required to calculate 
the PSM are presented in Section IV, and the tools corresponding to the probabilistic metrics are 
presented in Section V. The strategies proposed are exercised in the study of eleven controllers 
designed for the robust control challenge problem posed at the 1990 American Control Conference. 26 
Finally, a few concluding remarks close the paper. Extensions of this framework to control analysis 
and tuning are made in the companion paper [14]. 

II. Concepts and Notions 

The object of this paper is the evaluation of the robustness characteristics of closed-loop systems 
having a parametric mathematical model. The parameters which specify the closed-loop system 
are grouped into two categories: uncertain parameters, which are denoted by the vector p, and the 
control design parameters, which are denoted by the vector d. While the plant model depends on 
p, the controller depends on d. 
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The uncertainty model of p can be deterministic or probabilistic. A deterministic uncertainty 
model is prescribed by the Uncertainty Set A, while a probabilistic one is prescribed by a random 
vector. This vector is specified by the joint probability density function f p (p) defined over A. The 
uncertainty set of the probabilistic model is commonly called the Support Set. Hereafter, the terms 
uncertainty set and support set will be used interchangeably. By specifying the uncertainty model, it 
is implied that A contains the actual value of p , which is assumed to be time invariant. In principle, 
the uncertainty set can be unbounded and can even be the entire parameter space. In practical 
applications, the choice of this model is usually made by a discipline expert. However, the theory 
presented herein acknowledges that such a choice may be fairly arbitrary, and addresses the need for 
quantifying the level of tolerance of the controller to uncertainty in p as the closed-loop performance 
degrades. Any member of the uncertainty set is called a Realization. The Nominal Parameter 
value, denoted as p, is a parameter realization regarded as a good deterministic representation of 
p. Further, we will call the set of control design parameters of a baseline controller the Nominal 
Design point, d. 

Stability and performance requirements for the closed-loop system will be prescribed by the set 
of constraint functions, g(p,d) < 0, which depend on the uncertain parameters and the control 
parameters 21 . Throughout this paper, it is assumed that vector inequalities hold component wise. 
The larger the region in p-space where g(p, d) < 0 , the better the baseline controller. In the ideal 
case, such a region contains the support set A. Note that this implies that an infinite number of 
constraints must be satisfied, specifically, dirn(p) for each parameter realization. 

Sets in the parameter and design spaces, instrumental to the developments that follow, are 
introduced next. The Failure Domain is given by b 

Fp,d = «P> d ) : 9j{p, d) > 0}, (1) 

dim(g) 

= U Ka- < 2 > 

3 = 1 

While Equation (1) describes the failure domain corresponding to the jth requirement, Equation 
(2) describes the failure domain for all requirements. The Non-Failure Domain is the complement 
set of the failure domain and will be denoted c as T c . The names “failure domain” and “non-failure 
domain” are used because in the failure domain at least one constraint is violated while, in the 
non-failure domain, all constraints are satisfied. The solution set of equation ma Xj{gr •} = 0 usually 
partitions the space into these two domains. For control analysis purposes, the design point d 
will be kept at its nominal value d. In such a case, the projection of the failure domain onto the 
parameter space is given by 

3%{d) = {P ■ <P > d ) G (3) 

F p (d) = {p:(p,d)eF p , d }. (4) 

a The constraints in g may also implicitly depend on time or frequency. For instance, if a requirement is that the 
step response y(p,d,t) must not exceed the upper envelope y(t), the corresponding constraint is given by 

g = ma x{y{p, d, t ) - y(t)}. 

Maximizations over t, such as this one, will be evaluated by selecting the largest value assumed by the argument at 
the discrete points of a time simulation. Hence, the evaluation of g will not entail solving an optimization problem 
per se. 

b Throughout this paper, super-indices are used to denote a particular vector or set while numerical sub-indices 
refer to vector components, e.g., pi is the ith component of the vector p J . 

c The complement set operator will be denoted as the super-index c. 
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In the context of control analysis, which is the context of this paper, these two sets are also referred 
to as failure domains and are denoted as F 3 and T for simplicity in the notation. 

The Feasible Design Space , £ and the Robust Design Space , Q, are given by 

£(p) = {d: g(p,d) <0} , (5) 

Q(A) = {d : g(p, d) < 0,Vp e A}. (6) 

The controller with gains d will be called Robust if T and A do not overlap. In such a case, d 
belongs into the robust design space. Otherwise, the controller will be called Non-Robust. The 
level of robustness of a controller is related to the size and geometry of the non-failure domain. 
Note that Q C £ when p £ A. 


III. Set Deformations 

Some of the figures of merit proposed will result from deforming sets in the parameter space p. 
The mathematical background for such deformations is introduced next. 

Let be a set in p-space, called the Reference Set, whose geometric center is the nominal 
parameter p. The geometry of will be prescribed according to the relative levels of uncertainty 
in p. One possible choice for the reference set is a hyper-sphere. The hyper-sphere of radius R 
centered at p, denoted as S(p, R), is defined by 

S{p,R) = {p : \\p~p\\ < R} , 

where || • || denotes the Euclidean norm. Another choice might be to confine each component of the 
reference set to a bounded interval. This leads to a hyper-rectangular set. If m > 0 is the vector 
of half-lengths of such a set, the hyper-rectangle 7Z(p,m) is defined by 

7 Z(p, m ) = {p : p — m < p < p + m\} . 

Parameters with similar levels of uncertainty can be modeled using hyper-spherical sets. These 
sets could also be used for parameters with dissimilar levels of uncertainty if some scaling is used. 
However, whether scaling is used or not, a degree of dependence among parameters is introduced. 
For instance, the range of variability of one parameter depends on the values taken on by the others. 
Rectangular sets permit the consideration of dissimilar levels of uncertainty without the need for 
scaling and introduce no such dependence. Such levels are attained by making m, proportional to 
the level of uncertainty in p,. 

For the sake of clarity, the presentation that follows concentrates on the case where the nominal 
design point belongs to £ , i.e., when the controller satisfies the requirements for the nominal plant. 
One of the tasks of interest is to assign a measure of robustness to a controller based on measuring 
how much the reference set can be deformed before intersecting the failure domain. This requires 
specifying what we mean by a deformation. The Homothetic Deformation of with respect to the 
nominal parameter point p by a factor of a > 0, is the set H(£l, a) = {p + a(p — p) : p G fl}. The 
factor of this deformation, a, is called the Similitude Ratio. While expansions are accomplished 
when a > 1, contractions result when 0 < a < 1. Hereafter, deformations must be interpreted as 
homothetic expansions or contractions. For purposes of this paper, two uncertainty sets will be 
called Proportional if there exist a homothetic deformation that relates them, e.g., TZ(p,m) and 
7 Z(p, am) are proportional sets since 7i(TZ(p, m), a) = 7Z(p, am). 

Intuitively, one imagines that a set proportional to the reference set is being deformed until 
its boundary touches the boundary of the failure domain, i.e., until at least one member of the 
deformed set is at the verge of violating one or several of the closed-loop requirements (See Figure 
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1 ). Any point where the deforming set touches the failure domain is a Critical Parameter Value 
(CPV). The CPV, which will be denoted as p, might not be unique. The deformed set is called 
the Maximal Set (MS) and will be denoted as M p . The Critical Similitude Ratio (CSR), denoted 
as a, is the similitude ratio of that deformation. While the CSR is a non-dimensional number, 
the Parametric Safety Margin (PSM), denoted as p and defined in Section IV, is its dimensional 
equivalent. Both the CSR and the PSM quantify the size of the MS. While the CSR depends on 
the size of Cl, the PSM does not. 

P2 A 
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m 2 



m 1 


Pi 


Pi 



Figure 1. Relevant metrics in the deformation of a rectangular reference set. 


The formulations that follow depend on whether the controller with gains d satisfies the re- 
quirements for the plant at the nominal parameter point (i.e. , Nominal Plant ) or not. To make this 
distinction, the following function is introduced 

f 1 ifdef ^ 

[ — 1 otherwise. 

When 7 = — 1 , the controller does not satisfy the specifications for the nominal plant. In this case 
we want to determine the separation between the pair (p, d) E P p ,d and the non-failure domain 
■Fp d- The larger the separation the worse the controller. The need for assessing bad controllers 
results from the desire of searching for optimal ones in an automated fashion. 14 

Formulations that enable the deformation of hyper-spherical and hyper-rectangular sets in the 
parameter space are presented in the next section. These formulations require solving an optimiza- 
tion problem. Such a problem is non-convex when there are nonlinear parameter dependencies in 
g. In any non-convex optimization problem there is always the possibility of convergence to a local 
optimum instead of the global optimum. When this occurs, the estimated MS is not fully contained 
in the non-failure domain and the corresponding figures of merit are larger than those obtained 
when a global optimum is found. Absolute guarantees are not possible, but a variety of algorithmic 
safeguards can be used to compensate for this deficiency. For instance, g can be evaluated at few 
samples points in Ml, and if some happen to be in the failure domain, they can be used as initial 
conditions in subsequent searches. 

III. A. Deformation of hyper-spheres 

For 7 = 1 , the CPV for the jth requirement is given by 

pi = argmin { || p - p\\ : g^p, d) > 0} , (8) 

v 
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while the overall CPV is 


P = p k 


( 9 ) 


where 

k = argnrin {Up 6 7 — p||}- (10) 

l<j<dim(g) 

Hence, the CPV for each individual requirement is identified, and the closest of these CPVs to the 
nominal parameter point is the overall CPV. 

For 7 = — 1 , the CPV for the j th requirement is given by 

p> = argnrin { \\p - p\\ : gj(p, d) < 0} , (11) 

p 


while the overall CPV is 

p = argnrin { \\p - p\\ : g^p, d) < 0, j = 1 , . . . ,dim {g)} . (12) 

p 

In this case the overall CPV may not coincide with any of the p's since this point must be in the 
intersection of the non-failure domains corresponding to all requirements. If there exists a j such 
that p 7 does not exist, meaning that the deformation grew unbounded, the overall CPV does not 
exist either. 

Note that for 7=1, the nominal point p is not in the failure domain, and the CPV p is the 
parameter point on the boundary of the failure domain that is the closest to p. Similarly, for 
7 = — 1 the nominal point p is in the failure domain, and the CPV p is the parameter point in the 
non-failure domain that is the closest to p. Note that for 7 = 1, the CPV is the p value closest 
to p in the failure domain, while for 7 = — 1 , the CPV is the p value closest to p in the non- 
failure domain. To prevent the CPV from assuming values leading to infeasible plants, additional 
constraints must be used in Equation (8) and Equation ( 11 ), e.g., if p 1 is a mass, the constraint 
p 1 > 0 must be imposed. Further note that the critical requirement (s), i.e., any that prevents a 
larger deformation, is the one corresponding to g k . 

III.B. Deformation of hyper-rectangles 

Recall that the infinity norm is defined as ||as ||°° = sup,; {| *,; | } . Let us define the m-scaled infinity 

norm as ||*||“ = supj{|cc,;|/m,;}. A distance between the vectors * and y can be defined as 
II* — p||m- Using this distance, the hyper-rectangle 7 Z(p,m) is the unit ball centered at p, i.e., 
K{p, m) = {p : ||p - p||“ < 1}. 

The CPV corresponding to the deformation of the hyper-rectangular set fl = 7 Z(p, m) results 
from using Equations ( 8 - 9 ) or Equations ( 11 - 12 ) after replacing the Euclidean norm with the m- 
scaled infinity norm. Using the definition of the m-scaled infinity norm in Equation (8) leads 
to 

f |p. — p.| 

fp = argnrin < max — — : qAp. d) > 0 

P ll<i<dim(p) rm “ 

The “max” can be eliminated from the objective function , thereby removing a potential derivative 
discontinuity, by introducing the similitude ratio a defined earlier 

(p 7 , cP) = argnrin { a : gj{p, d) > 0 ,p — am < p < p + am} . ( 13 ) 

p,a 

Hence, for the 7 = 1 case, the CPV for each individual constraint function is solved for, and the 
closest of these CPVs to the nominal parameter point according to the m-scaled infinity norm is 
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the overall CPV. The statements on the need for additional constraints and on the interpretation 
of the CPV made in the previous section hold. 

Once the CPV has been found, the MS is uniquely determined and its size can be readily 
measured. Developments for this are presented next. 

IV. Figures of Merit for Deterministic Uncertainty Models 

The Spherical PSM is defined as 


Ps(P) = 7||P-Pll> ( 14 ) 

where p is the CPV resulting from Equations ( 8 ) or (9) when 7 = 1, or from Equations (11) or 
(12), when 7 = —1. The corresponding CSR is a = \pg\/R, and the MS is given by 

M p = S(p, aR). (15) 

If the overall CPV is used and 7 = 1 , M p is the largest hyper-sphere centered at p which fits 
within the non-failure domain. Conversely, if 7 = — 1 , Af p is the the largest hyper-sphere centered 
on p which fits within the failure domain. 

On the other hand, the Rectangular PSM is defined as 

pr ( p ) = 7«IIHI> ( 16 ) 

where the CSR is a = \\p — p ||“ and p is given by the m-scaled infinity norm version of Equations 
(8-9) (i.e. Equation(13)) when 7 = 1, or of Equations (11-12) when 7 = —1. The corresponding 
MS is given by 

M p = 7Z(p,am). (17) 

As stated previously, if the overall CPV is used and 7 = 1 , the MS is the largest hyper-rectangle 
proportional to 7 Z(p,m) which fits within the non-failure domain J- c . Conversely, if 7 = — 1 , the 
MS is the largest hyper-rectangle that fits within the failure domain T. If the CPV of the jth 
requirement is used instead, these remarks apply to ( T 3 Y and T 3 respectively. For 7 = 1 , the 
overall PSM coincides with the smallest individual PSM, i.e., p(p) = min{p(p ? )}. This does not 
hold when 7 = —1, in which case the smallest individual PSM is just an upper bound to the overall 
PSM, i.e., p(p) < minj/^p 7 )}. 

Because the CSR and the PSM measure the size of the MS, their values are proportional to 
the degree of robustness of the controller associated with d to uncertainty in p. The CSR is non- 
dimensional, but depends on both the shape and the size of the reference set. The PSM has the 
same units as the uncertain parameters, and depends on the shape, but not the size, of the reference 
set. The sign convention enforced by 7 in Equations (14,16) implies the following. If the PSM takes 
on a negative value, the controller does not even satisfy the requirements for nominal parameter 
point. If the PSM is zero, the controller’s robustness is practically nil since there are infinitely small 
perturbations of p leading to the violation of at least one of the requirements. If the PSM is positive, 
the requirements are satisfied for parameter points in the vicinity of the the nominal parameter 
point. The larger the PSM, the larger the variation from the nominal parameter point to which 
the uncertain parameter can be subjected without leading to a violation of a requirement. Overall, 
the larger the PSM the more robust is the controller (i.e., the further the nominal parameter point 
of the failure domain), with a negative PSM being unacceptable. 

Traditionally, robustness analysis is made by setting forth an uncertainty set and checking if the 
closed-loop performance is satisfactory for all set members. This applies to both, real parameter 
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uncertainty and model form- uncertainty (e.g., unmodeled dynamics). A robustness analysis test of 
this kind based on the developments above is available. 12 

Determination of whether a controller is robust or not for a given hyper-spherical or hyper- 
rectangular set A, is a matter of making D = A and calculating the value of the CSR. The 
controller is robust iff the CSR is greater or equal to one. A controller might turn out to be non- 
robust (recall the definition of non-robust) because of an overly-large uncertainty set or because 
the requirements are too stringent. If the uncertainty model and the design requirements are not 
relaxed, the only choice is to change the control structure such that a robust controller can be 
found. This practice however, usually leads to complex, high-order controllers. Other options may 
be to (i) relax the closed-loop requirements, (ii) reduce the size of the uncertainty set, or (iii) allow 
for requirement violations with a small probability. Since uncertainty models are never perfect, 
the closed-loop stability and performance guarantees derived from using a prescribed uncertainty 
model, e.g., A or f p (p), should be interpreted with the same level of rigor used to prescribe such 
a model. 


V. Figures of Merit for Probabilistic Uncertainty Models 

Metrics and tools for the control verification of systems having a probabilistic uncertainty model 
are presented next. Note that the only information from the probabilistic model that is used in 
determining if a controller is robust is the support set of the probabilistic density function and 
not the actual distribution of the uncertain parameters. Therefore, the developments that follow 
are suited for controllers that are non-robust. The analysis of such controllers entails quantifying 
the severity by which the design requirements are violated. In the context of the developments 
presented thus far, one quantifier for this is the volume of the set AnAdp. This metric approximates 
the failure domain, and evaluates its probability for the case where all parameter realizations are 
uniformly distributed. Such an assumption is inadequate if one regards parameter realizations closer 
to the nominal parameter point as more important /likely than the ones further away. To properly 
account for the relative importance of all parameter realizations, a probabilistic uncertainty model 
can be used. The value of the joint density function at each particular parameter realization can 
be interpreted as a measure of our belief that such a realization is the true value of the uncertain 
parameter. In this setting, a natural quantifier of robustness is the probability of violating the 
design requirements. This probability, called the Failure Probability, will be denoted as P\J-\. The 
failure probability is zero for robust controllers, while it is greater than zero for non-robust ones. 
Clearly, the larger P[J~], the more severe the violation. It is worth noticing that small values of 
P[F] do not necessarily imply that the design is in the feasible design space, i.e. , is it possible to 
attain P[P] <C 1 when there exists a j for which gj(p, d) > 0. 

The main appeal of the developments that follow is that they will enable the comparison of 
simple controllers along with complex ones from a practical perspective, (e.g., for 99% of the 
plants the closed-loop performance of a PID controller may be indistinguishable from the one of a 
high-order controller). Since no uncertainty model is perfect, one may accept using a non-robust 
controller with a simple control structure when its corresponding probability of failure is sufficiently 
small. Forcing the controller to attain zero failure probability may lead to complex controllers whose 
performance is as good as that of much simpler controllers for most parameter realizations. 

As opposed to the contributions in [15-18] on probabilistic controls, the developments herein 
are not intended to alleviate the computational burden of pursuing worst-case robust stability, but 
to enable the discrimination among events in the set of all possible closed-loop system performances 
according to their chance of occurrence. This has the potential to address and alleviate the demands 
on the controller complexity imposed by worst-case control policies. In this regard, this paper is 
better aligned with the developments in References [2, 19-21] and with the idea of handling some 
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of the requirements as soft constraints. 22,23 

Hereafter, we assume that a probabilistic uncertainty model is available. Recall that such a 
model is prescribed by the joint probability density function f p (p), or equivalently by the joint 
cumulative distribution function F p (p), defined over A. The framework for the calculation of three 
probabilistic figures of merit, — the Reliability Index (RI), an upper bound to the failure probability, 
and the failure probability itself — is presented next. 

V.A. Reliability Indices 

The calculation of probabilities can be better performed in spaces other than p-space. The most 
relevant of these spaces is the standard normal space, commonly referred to as the M-space. In 
u-space, the multi-variate probability density function becomes an uncorrelated normal density 
function with zero mean and unit standard deviation, whose value decreases as exp(— ||u|| 2 /2). For 
many useful probability distributions, one can find a probability preserving parameter transforma- 
tion, 24 denoted hereafter as u = U(p ), that maps the requirements from p-space to u-space such 
that P[U{F)} = P[F\. 

The formulations introduced in Section III that enable the deformation of sets in p- space can be 
easily extended to the w-space. An obvious parallelism between the concepts, notions and equations 
introduced earlier and the ones used here is apparent. For instance, if H = S(u, R ), and 7 = 1, the 
CPV corresponding to the jth requirement is given by 

v? = argrnin { ||« — ii|| : g j(U~ 1 (u),d) > 0} , (18) 

U 

while the overall CPV is given by 

u = u k , (19) 

where 

k = argrnin {||m j — -uU} . 

l<?<dim(g) 

These equations are analogous to Equations (8-9). A natural choice is u = 0 because in standard 
normal space most of the probability is concentrated about the origin (it is mean). 

In regard to eliminating infeasible plants when performing deformations in ti-space, it is suffi- 
cient to prescribe a support set A in p-space only made of feasible realizations. However, upper 
bounds on ||u|| should be imposed when searching for the CPV, in order to avoid the divergence 
and error caused by the numerical evaluation of U and its inverse. These bounds can be chosen 
large enough so the neglected portion of the u-space has negligible probability. 

Analogous to the spherical PSM is the Spherical RI, which is given by 

Ps{u) = j\\u - u\\. (20) 

The corresponding MS is given by 

M u = S{u,aR ), (21) 

where a = \/3s\/R- Analogous to the rectangular PSM is the Rectangular RI, which is given by 

Pr(u) = 7 a||m||, (22) 

where a = \\u — The corresponding MS is given by 

M u = lZ(u,arn). (23) 
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If the controller is robust, none of the optimization problems posed in this section has a finite 
solution since the failure domain in u-space is empty. The RI exists if and only if the failure 
probability is non-zero, i.e. , the controller is non-robust. As before, for 7=1 the overall RI 
coincides with the smallest individual RI, e.g., (3{u) = minj/^iP)}, while for 7 = — 1 the smallest 
individual RI is an upper bound to the overall RI, e.g., (3 (u) < min{/?(iP)}. Note that if the 
overall CPV is used and 7 = 1 , A4 U is the largest set proportional to 11 which fits within U(J- C ). 
Conversely, if 7 = — 1, A4 U is the largest set proportional to H that fits within U(J-). If the CPV 
of the jth requirement is used instead, these remarks apply to U((P^) C ), and U(P^) respectively. 

The developments of this paper require setting both an uncertainty model and a reference 
set. Guidance on how to select the latter is given next. For p-deformations, the relative levels of 
uncertainty among the components of p are fully prescribed by the p-space reference set which, for 
this part of the discussion, will be denoted as H p . In contrast, for w-deformations these levels depend 
on both, the w-space reference set Ll u , and the probability density function / P (p). The manner in 
which the geometry of l! u , and the shape of f p (p ) determines these levels is exemplified in Figures 2 
and 3. Therein, unimodal and bimodal density functions with Q u = 5(0, R ), and Hu = 7L(0, 1) are 
considered. The subplots in the left column show the probability density function. A homothetic 
deformation in w-space can be seen as a deformation in p-space where the boundary of an expanded 
set is the image under U _1 of the points on the surface of M u that attain a fixed RI value. The 
center and right columns of subplots show these boundaries, to be referred to as RI contours, for 
various values of the spherical and rectangular RI. 

Note that (i) images under U of proportional sets in u-space do not correspond to proportional 
sets in p- space, (ii) the RI contours do not coincide with those of / P (p), (iii) the center and the 
aspect ratio of the rectangular RI contours change with the value of the RI, and (iv) U~ l (M. u ) 
approaches A as the RI approaches infinity. It is apparent that the geometry of Hu affects the 
relative levels of uncertainty. To preserve the levels set by / p (p), VL U must be a hyper-sphere or 
a hyper-cube centered at the origin. For instance, if p is a normally distributed random vector 
having the mean p, and covariance matrix diagjer 2 }, 7 Z(p,acr) = U~ l {JZ{Q,al)). Therefore, the 
selection of Vt u = 7£(0, 1) enables that er, variable that describes the relative levels of uncertainty in 
f p (p), be also the aspect ratio m of the rectangular RI contours. Note however, that the geometry 
of the reference set can be adjusted as desired. The developments in the next sections indicate 
that reference sets leading to larger maximal sets are desirable. Such sets may not preserve the 
uncertainty levels prescribed by / P (p). 

Strategies for the calculation of upper bounds to the failure probability based on the deforma- 
tions of sets in p- and u-space are presented next. 

V.B. Upper Bounds to Failure Probability 

In this section we use the MS calculated above to derive analytical bounds to the failure probability. 
The following Lemma provides the basic mathematical background for this. 

Lemma 1 (Bounding Interval). Let ip = 1 — P[M\, where A4 is the MS. The bounding interval I, 
which satisfies P[P] G X, is given by 1 = (0, ip] for 7 = 1 , and by 1 = [1 — ip, 1) otherwise. 

Proof: Assume that 7 = 1 . Since P[P] + P[P C ] = 1, and M C T c so P[M\ < P[P C ]. It follows 
that P[P] < 1 — P[M] = ip. Since for 7 = —1, A4 is chosen so that A4 C P, it follows that 
P[P] > 1 -ip. □ 

Because these bounds result from calculating the probability of an event, and in contrast to several 
other bounds available in the literature, their value always lies between zero and one. Note that 
there is a bounding interval for each reference set. Denote the left and right end points of the 
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Figure 2. Rl contours for a unimodal probability density function. 


bounding interval by by X; and T r respectively. If X denotes the bounding interval corresponding to 
all requirements and X J the one corresponding to the jth requirement, X = (0,min{Xr}] for 7 = 1 , 
and X = [li, 1), where X; < max{X^}, for 7 = —1. Hereafter, our discussion will concentrate on 
7 = 1 , in which case if is an upper bound to P[F]. 

When the deformation leading to the MS takes place in p-space, we will use the notation 


V> P = 1 - P[M p \. 


(24) 


If the components of p are independent random variables and Ll is hyper-rectangular, P[A4 p \ can 
be evaluated analytically in a straightforward manner. 

Lemma 2 (Hyper-rectangles in p-space). Let p R be the rectangular PSM corresponding to the 
deformation of the reference set H = 7 Z(p,m), and to the constraint set g(p,d) > 0. Denote the 
Cumulative Distribution Function of the probabilistic uncertainty model F p , where p is a vector of 
independent random variables. In this context, Equation (24) leads to 


dim (p) 

fjpip, m, p R ) = 1 - F Pi 

i— 1 



PRirii 


m 


~Fr, 



p R m 1 


m 


(25) 


The proof of this Lemma is trivial, and results from evaluating the probability of M p for 
Ai p = 1Z(p,am). The main advantage of using Equation (25) is that the MS, and therefore the 
PSM, are independent of the probabilistic uncertainty model assumed. This implies that bounds 
corresponding to arbitrary uncertainty models are trivial to evaluate since they will only require 
changing F p in Equation (25). 
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Figure 3. RI contours for a bimodal probability density function. 


Tighter upper bounds are obtained if the reference set chosen leads to a larger P[A4\. Experience 
has shown that this can be more easily attained by working in the standard normal space. In 
particular, deformations of reference sets in u-space leading to maximal sets containing the vicinity 
of the origin usually produce smaller bounds. For these deformations we will use the notation 

^u = l -P[M U \. (26) 

While if p can be estimated analytically for arbitrary hyper-rectangular sets, if u can also be esti- 
mated for hyper-spherical sets centered at u = 0. The following two Theorems, whose proofs are 
given in Reference [13], present the corresponding closed- form expressions. 

Theorem 1 (hyper-spheres in w-space). Let (5g be the spherical RI corresponding to the deformation 
of the reference set 12 = 5(0, R), and the constraint set fir(t/ _1 (u), d) > 0. Let l = dim(p). In this 
case, Equation (26) is equivalent to 


il’uiPs) = 1 - Az(|/?s|), 


(27) 


where A i{r), which is the cumulative distribution function of a chi- distributed random variable with 
l degrees of freedom, is given by 


A i(r) 




1 - 
0 


0 - 2 ) 1 ! 

. 1—4 

+ ' 


0 - 4 )! 


+ ••• + 


JL \ p~r 2 l 2 
1 !! 


0—4)!! 


• + fry + 1 


=-r 2 /2 


if r > 0, l odd 
if r > 0, l even 
otherwise 
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and n\\ is the double factorial d . 

Theorem 2 (hyper-rectangles in u-space). Let (3 r be the rectangular RI corresponding to the 
deformation of the reference set 17 = 7 Z(u,m), and the constraint set g{U~ l {u),d,t) > 0. In this 
case, Equation (26) is equivalent to 


dim (p) 

i> u (u,m,p R ) = 1- $ 

i= 1 



||m|| J 


- $ 



(28) 


where $ is the cumulative distribution function of the univariate standard normal random variable. 

Recall that ip p G (0, 1] and if u £ (0, 1]. For a given f p (p), g , d, we have no general rule that 
determines which reference set leads to the smallest upper bound. However, we know that the 
maximal sets leading to small upper bounds contain points where ||u|| is small. For a different 
uncertainty model, the bounds in Equation (26) require solving another optimization problem in 
order to identify a new (3r. This is in sharp contrast to the bounds in Equation (25) where the 
MS is independent of the uncertainty model. Note that while Lemma 2 can be applied to robust- 
and non-robust controllers, Theorems 1 and 2 are only applicable to non-robust ones. This is so 
because for robust controllers M. u is unbounded. Equations (25), (27) and (28) lead to guaranteed 
upper bounds to the failure probability. 


V.C. Failure Probability 

The problem of finding P[P], or equivalently P[U(P)\, is usually difficult since it requires evaluating 
a multi-dimensional integral over a complex integration domain. Methods for estimating the failure 
probability include sampling based techniques, such as Monte Carlo sampling, the First Order 
Reliability Method, 24 and the hybrid method. 13 

The hybrid method, which is used in the example of Section VI, approximates the failure 
probability by combining sampling with the upper bounds introduced above. Once the MS has 
been determined, an arbitrary sample point can be easily tested for membership in this set. If 
the sample point lies within the MS, it is unnecessary to go through the computational expense of 
evaluating g , since the outcome is now known. The numerical advantage of using this method is 
a consequence of not having to evaluate g at these realizations. The method is especially suitable 
when the number of evaluations of g required to determine the MS is considerably less than the 
number of samples falling within the MS. The efficiency of the hybrid method increases with the 
absolute value of the RI. In addition, the accuracy of the method using n samples outside the MS 
is comparable to the one of Monte Carlo using N = floor (n/if) samples. In the context of control 
analysis, a particularly attractive feature of the hybrid method is that its efficiency and accuracy 
does not depend on the robustness of the controller. 25 This sharply contrasts with the case in 
Monte Carlo-based methods, where accurate robustness assessments (i.e., those based on statistics 
having small confidence intervals) demand a number of simulations that grow exponentially with 
the robustness of the controller. In other words, the better the robustness, the smaller the P[P] 
and the larger the number of samples required to estimate this probability accurately. Details on 
the implementation of the hybrid method and its analysis are available in References [13,25]. 

Now that all the figures of merit have been introduced, it is worth noticing a conceptual differ- 
ence in the way they measure robustness. While the PSMs, the RIs, and the upper bounds to the 

d Recall that the double factorial is defined as 


( n- 

(n- 2) • 

• • 5 • 3 • 1 

n > 0 and odd 

\ n ' 

(n - 2) ■ 

■ • 6 • 4 • 2 

n > 0 and even 

l 1 



n = -1,0 
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failure probability have a notion of robustness based on the closeness of the nominal parameter point 
to the failure domain, the failure probability itself quantifies the portion of all possible realizations 
falling into the failure domain. As such, the estimation of P\J~\ does not require the definition of a 
nominal parameter point or a nominal plant, and designs attaining small failure probabilities may 
have their corresponding failure domain very close to the realizations where f p (p ) is the largest. 
Designs that attain both small P[P] and large separation between the nominal parameter point 
and the failure domain are best suited for the hybrid method because of its usage of the failure 
bounding sets. Notice that this dual notion of robustness cannot be assessed or pursued by using 
Monte Carlo sampling. 

VI. Example: Benchmark Robust Control Problem 
VI. A. Problem Statement 

The verification and comparative analysis of controllers designed for the robust control challenge 
problem posed in the 1990 American Control Conference [26] are considered here. The benchmark 
system, shown in Figure 4, is a two-mass/spring system with a non-collocated sensor actuator pair. 
Several design problems were posed based on this setting. In all of them, stability and performance 


| ► X 1 | ► X 2 


U ► 



m 2 

w, — ►! 


k 



0 0 


0 0 


7777777777777777777777 


Figure 4. Two-mass spring system. 


requirements in the time domain were prescribed for plants with uncertain masses and stiffness 
whose values lie within a bounded set. As in Reference [27], additional sources of uncertainty are 
considered herein to fully exercise the scope of the methodology. We added a non-linear spring with 
constant k n , a time delay r denoting a first order lag between controller command and actuator 
response, and a multiplicative loop-gain uncertainty / resulting from variation in sensors, control 
gain, and/or actuator failure. The state space plant model is 

xi = x 3 

x 2 = x 4 

x 3 = — (x 2 - xi) + — (x 2 - xi ) 3 + — , 
m i m,\ mi 

h t \ i k n 3 W 2 

m 2 m 2 m 2 

TU = U c ~ U. 

While the output z and the observed variable y are both equal to x 2 , only the disturbance w 2 
will be active. The uncertain parameter vector is p = [mi, m2, k, k n , r, f] T whose nominal value is 
p = [1, 1, 1,0,0, 1] T . Note that the nominal values of the additional parameters lead to the plant 
used in the original benchmark problem. In order to prevent deformations leading to infeasible 
plants, the constraints mi > 0, m 2 > 0, k > 0, r > 0 and / > 0 are imposed on the optimization 
problem used to calculate the CP Vs. The specifications imposed on the closed-loop system are 
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1. Local closed-loop stability. 

2. Settling time: the response to a unit-impulse must fall between ±0.1 after 15s. 

3. Control saturation: the control signal corresponding to the impulse response must fall between 

± 1 . 

In the context of this paper, the corresponding set of constraints is 

9 = ™{|z(t)|} - 0.1, max{[u(f)|} - 1 

l<l<n p £>15 £>0 

where s l is a closed-loop pole of the linearized system and 5R(-) is the real part operator. Eleven 
controllers were designed for the above problem by several authors. The controllers have been 
designed using several different methods, including robust H^, loop-transfer recovery, imaginary- 
axis shifting, constrained optimization, structured covariance, game theory, the internal model 
principle 27, 28 and /i-synthesis. 29 A Monte Carlo-based analysis of some of these controllers is 
available in Reference [27]. 

The state space representation of a controller is given by 

± c = A c x c + B c y, 
u c = C c x c + D c y, 

where x c is the controller state, u c is the actuator command, and A c , B c , C c , and D c are the 
controller matrices. The controllers considered here are the ones labeled as A, B , C. D, E, F, and 
H in Reference [27], and the controllers designed for problems one and two in Reference [28] and 
Reference [29]. In this paper, the controllers from Reference [28] will be labeled as W\ and IL 2 , 
and those from Reference [29] will be labeled as B\ and B 2 . 

VI. B. Control Verification 

In this section we perform the control verification of the above controllers. In the context of this 
example, the CPV is the critical combination of uncertain physical parameters, nonlinearity, time 
delay, and control effectiveness degradation for which the closed-loop specifications are at the verge 
of being violated (providing they are satisfied for the nominal plant). 

The deformation of the reference set 7 Z(p,m) is considered first. The relative levels of uncer- 
tainty among the parameters are assumed to be m = [4, 4, 5, 2, 1, 2] T , e.g., we expect four times 
more uncertainty in the value of the masses than in the value of the time delay. Note that even 
though the values in m are subjective, the resulting MS is always fully contained in the non-failure 
domain. Table 1 presents the stability margins and the PSMs corresponding to the three require- 
ments. According to the results, only Ibj , B\ and B -2 satisfy the requirements for the nominal 
plant. While W 2 has the best figure of merit in regard to stability and control saturation, the 
settling time requirement is best satisfied by controller D. The gain and phase margins for the 
nominal plant are not reliable indicators of robust stability because they are independent of the 
way in which the plant depends on p. Note that they are not always proportional to the PSM. The 
controller attaining the best compromise is B 2 , design for which p/j = 0.038. 

Assessments using a probabilistic uncertainty model are presented next. For this, we assume 
that mi, m 2 , k, k n , r and / are independent, Beta-distributed random variables with shape param- 
eters, [5,5], [5,5], [2,3.7], [6,6], [0.3,5], and [0.5, 1.5], having the support sets [0,2], [0,2], [0.5,2], 
[—0.5, 0.5], [0, 0.1] and [0.5, 1.5], respectively. This probabilistic model has been set such that p and 
C/ _1 (0) are in £. The ranges of variation of the parameters and the shapes of the distributions are 
assigned according to engineering judgment. 
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Table 1. Stability margins, and rectangular PSMs. 


Controller 

Gain 

[db] 

Phase 

[deg] 

Stability 
PR (R 1 ) 

Settling time 
PR ( P 2 ) 

Control 
PR (P 3 ) 

A 

2.5 

-20.6 

0.320 

-0.019 

0.368 

B 

3.2 

26.7 

0.490 

-0.175 

0.523 

C 

3.3 

26.6 

0.501 

-0.189 

0.533 

D 

15.1 

57.2 

0.562 

0.212 

—00 

E 

2.4 

22.2 

0.394 

-0.259 

0.233 

F 

5.2 

23.9 

0.419 

0.012 

-3.277 

H 

3.4 

24.8 

0.510 

-0.005 

0.524 

W\ 

3.3 

24.5 

0.501 

0.001 

0.517 

w 2 

6.0 

34.2 

0.754 

-0.024 

0.639 

Bi 

1.8 

18.9 

0.300 

0.020 

0.003 

b 2 

2.8 

27.2 

0.437 

0.038 

0.141 


Deformations of hyper-spherical reference sets in u-space lead to the results in Table 2. Ac- 
cording to the RIs, the controller D is the one with best stability and settling time characteristics 
while W 2 has the best figure of merit for control saturation. As in the previous case, only W \ , 
B\ and B 2 satisfy the requirements for the nominal plant while B 2 is the most robust of all con- 
trollers. Conclusions based in the RI coincide with the ones based on the upper bound, so results 
corresponding to the latter have been omitted. 

The values of P[J- 3 ], calculated using the hybrid method with n = 1000 samples, are shown 
in Table 3. Recall that P\E\ does not depend on whether the nominal point is in the feasible 
design space or not. According to this metric, D is the best controller in stability and settling time, 
while W 2 is the best for control saturation. Values of P[P] for W \ , B\ and B 2 , which were the 
only controllers satisfying the requirements for the nominal plant, were calculated using n = 2000 
samples. The resulting values, which are 0.908, 0.980 and 0.873 respectively, indicate that B 2 is 
the controller with best robustness characteristics. Since the failure probabilities are large, the 
advantage of using the hybrid method, as compared to sampling is moderate. 

The control assessments above are consistent even though they use different uncertainty models 
and figures of merit. These analyses determine not only which is the limiting design requirement for 
each controller, but more importantly, how the levels of robustness corresponding to all requirements 
compare among themselves. 


VII. Concluding Remarks 

Figures of merit for control verification that quantify a controller’s ability to satisfy the closed- 
loop requirements in the presence of uncertain parameters are proposed. The framework developed 
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Table 2. Spherical RIs. 


Controller 

Stability 
As {u 1 ) 

Settling time 

As (u 2 ) 

Control 

As (* 3 ) 

A 

0.665 

-0.037 

0.913 

B 

0.992 

-0.319 

1.169 

C 

1.01 

-0.336 

1.191 

D 

2.366 

0.598 

— oo 

E 

0.690 

-3.517 

0.374 

F 

1.627 

0.025 

— oo 

H 

1.050 

-0.009 

1.174 

W\ 

1.027 

0.0009 

1.152 

w 2 

2.147 

-0.072 

2.287 

Bi 

0.497 

0.030 

0.005 

b 2 

0.852 

0.066 

0.236 


is applicable to systems whose functional dependence on the uncertain parameters is arbitrary, 
and for which stability and performance requirements are present. The figures of merit are the 
parametric safety margin, the reliability index, the failure probability, and upper bounds to this 
probability. The tools used to calculate these metrics are based on the solution to optimization 
problems whose formulation and solution does not introduce conservatism. The parametric safety 
margin enables quantification of robustness when uncertainty is prescribed as a set. The other 
metrics, for which a probabilistic uncertainty model is required, account for the chance of occurrence 
of any given plant within the uncertainty set and therefore for the likelihood of unsatisfactory 
closed-loop performance. As compared to sampling-based methods, the efficiency and accuracy of 
the tools proposed is substantially better. This improvement is particularly advantageous when the 
controllers are highly robust, a case when the computational expense of an accurate sampling-based 
analysis is impractical. This framework enables a fair comparison of controllers designed using 
different methods and assumptions. The justification of adopting complex control architectures 
and the determination of the consequences of violating such assumptions are aspects that can be 
naturally evaluated using this framework. 
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Table 3. Failure Probabilities via the hybrid method. 


Controller 

Stability 

P^ 1 ] 

Settling time 
P[E 2 } 

Control 

P[E 3 } 

A 

0.272 

0.971 

0.158 

B 

0.143 

0.957 

0.119 

C 

0.130 

0.967 

0.104 

D 

0.007 

0.333 

1 

E 

0.219 

0.999 

0.426 

F 

0.080 

0.871 

1 

H 

0.138 

0.914 

0.188 

Wi 

0.119 

0.907 

0.174 

w 2 

0.014 

0.875 

0.010 

B\ 

0.313 

0.976 

0.601 

b 2 

0.196 

0.798 

0.462 
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